tools/iptables-unit.c

   1 /*
   2  *
   3  *  Connection Manager
   4  *
   5  *  Copyright (C) 2013-2014  BMW Car IT GmbH.
   6  *
   7  *  This program is free software; you can redistribute it and/or modify
   8  *  it under the terms of the GNU General Public License version 2 as
   9  *  published by the Free Software Foundation.
  10  *
  11  *  This program is distributed in the hope that it will be useful,
  12  *  but WITHOUT ANY WARRANTY; without even the implied warranty of
  13  *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  14  *  GNU General Public License for more details.
  15  *
  16  *  You should have received a copy of the GNU General Public License
  17  *  along with this program; if not, write to the Free Software
  18  *  Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA  02110-1301  USA
  19  *
  20  */
  21
  22 #ifdef HAVE_CONFIG_H
  23 #include <config.h>
  24 #endif
  25
  26 #include <glib.h>
  27 #include <errno.h>
  28
  29 #include "../src/connman.h"
  30
  31 static bool assert_rule(int type, const char *table_name, const char *rule)
  32 {
  33         char *cmd, *output, **lines;
  34         GError **error = NULL;
  35         int i;
  36         bool ret = true;
  37
  38         switch (type) {
  39         case AF_INET:
  40                 cmd = g_strdup_printf(IPTABLES_SAVE " -t %s", table_name);
  41                 break;
  42         case AF_INET6:
  43                 cmd = g_strdup_printf(IP6TABLES_SAVE " -t %s", table_name);
  44                 break;
  45         default:
  46                 return false;
  47         }
  48
  49         g_spawn_command_line_sync(cmd, &output, NULL, NULL, error);
  50         g_free(cmd);
  51
  52         lines = g_strsplit(output, "\n", 0);
  53         g_free(output);
  54         if (!lines)
  55                 return false;
  56
  57         for (i = 0; lines[i]; i++) {
  58                 DBG("lines[%02d]: %s\n", i, lines[i]);
  59                 if (g_strcmp0(lines[i], rule) == 0)
  60                         break;
  61         }
  62
  63         if (!lines[i])
  64                 ret = false;
  65
  66         g_strfreev(lines);
  67         return ret;
  68 }
  69
  70 static void assert_rule_exists(int type, const char *table_name,
  71                                                         const char *rule)
  72 {
  73         if (type == AF_INET) {
  74                 if (g_strcmp0(IPTABLES_SAVE, "") == 0) {
  75                         DBG("iptables-save is missing, no assertion possible");
  76                         return;
  77                 }
  78         }
  79
  80         if (type == AF_INET6) {
  81                 if (g_strcmp0(IP6TABLES_SAVE, "") == 0) {
  82                         DBG("ip6tables-save is missing, no assertion possible");
  83                         return;
  84                 }
  85         }
  86
  87         g_assert(assert_rule(type, table_name, rule));
  88 }
  89
  90 static void assert_rule_not_exists(int type, const char *table_name,
  91                                                         const char *rule)
  92 {
  93         if (type == AF_INET) {
  94                 if (g_strcmp0(IPTABLES_SAVE, "") == 0) {
  95                         DBG("iptables-save is missing, no assertion possible");
  96                         return;
  97                 }
  98         }
  99
 100         if (type == AF_INET6) {
 101                 if (g_strcmp0(IP6TABLES_SAVE, "") == 0) {
 102                         DBG("ip6tables-save is missing, no assertion possible");
 103                         return;
 104                 }
 105         }
 106
 107         g_assert(!assert_rule(type, table_name, rule));
 108 }
 109
 110 static void test_iptables_chain0(void)
 111 {
 112         int err;
 113
 114         err = __connman_iptables_new_chain(AF_INET, "filter", "foo");
 115         g_assert(err == 0);
 116
 117         err = __connman_iptables_commit(AF_INET, "filter");
 118         g_assert(err == 0);
 119
 120         assert_rule_exists(AF_INET, "filter", ":foo - [0:0]");
 121
 122         err = __connman_iptables_delete_chain(AF_INET, "filter", "foo");
 123         g_assert(err == 0);
 124
 125         err = __connman_iptables_commit(AF_INET, "filter");
 126         g_assert(err == 0);
 127
 128         assert_rule_not_exists(AF_INET, "filter", ":foo - [0:0]");
 129 }
 130
 131 static void test_iptables_chain1(void)
 132 {
 133         int err;
 134
 135         err = __connman_iptables_new_chain(AF_INET, "filter", "foo");
 136         g_assert(err == 0);
 137
 138         err = __connman_iptables_commit(AF_INET, "filter");
 139         g_assert(err == 0);
 140
 141         err = __connman_iptables_flush_chain(AF_INET, "filter", "foo");
 142         g_assert(err == 0);
 143
 144         err = __connman_iptables_commit(AF_INET, "filter");
 145         g_assert(err == 0);
 146
 147         err = __connman_iptables_delete_chain(AF_INET, "filter", "foo");
 148         g_assert(err == 0);
 149
 150         err = __connman_iptables_commit(AF_INET, "filter");
 151         g_assert(err == 0);
 152 }
 153
 154 static void test_iptables_chain2(void)
 155 {
 156         int err;
 157
 158         err = __connman_iptables_change_policy(AF_INET, "filter", "INPUT", "DROP");
 159         g_assert(err == 0);
 160
 161         err = __connman_iptables_commit(AF_INET, "filter");
 162         g_assert(err == 0);
 163
 164         err = __connman_iptables_change_policy(AF_INET, "filter", "INPUT", "ACCEPT");
 165         g_assert(err == 0);
 166
 167         err = __connman_iptables_commit(AF_INET, "filter");
 168         g_assert(err == 0);
 169 }
 170
 171 static void test_iptables_chain3(void)
 172 {
 173         int err;
 174
 175         err = __connman_iptables_new_chain(AF_INET, "filter", "user-chain-0");
 176         g_assert(err == 0);
 177
 178         err = __connman_iptables_commit(AF_INET, "filter");
 179         g_assert(err == 0);
 180
 181         assert_rule_exists(AF_INET, "filter", ":user-chain-0 - [0:0]");
 182
 183         err = __connman_iptables_new_chain(AF_INET, "filter", "user-chain-1");
 184         g_assert(err == 0);
 185
 186         err = __connman_iptables_commit(AF_INET, "filter");
 187         g_assert(err == 0);
 188
 189         assert_rule_exists(AF_INET, "filter", ":user-chain-0 - [0:0]");
 190         assert_rule_exists(AF_INET, "filter", ":user-chain-1 - [0:0]");
 191
 192         err = __connman_iptables_delete_chain(AF_INET, "filter", "user-chain-1");
 193         g_assert(err == 0);
 194
 195         err = __connman_iptables_commit(AF_INET, "filter");
 196         g_assert(err == 0);
 197
 198         assert_rule_exists(AF_INET, "filter", ":user-chain-0 - [0:0]");
 199         assert_rule_not_exists(AF_INET, "filter", ":user-chain-1 - [0:0]");
 200
 201         err = __connman_iptables_delete_chain(AF_INET, "filter", "user-chain-0");
 202         g_assert(err == 0);
 203
 204         err = __connman_iptables_commit(AF_INET, "filter");
 205         g_assert(err == 0);
 206
 207         assert_rule_not_exists(AF_INET, "filter", ":user-chain-0 - [0:0]");
 208 }
 209
 210 static void test_iptables_rule0(void)
 211 {
 212         int err;
 213
 214         /* Test simple appending and removing a rule */
 215
 216         err = __connman_iptables_append(AF_INET, "filter", "INPUT",
 217                                         "-m mark --mark 1 -j LOG");
 218         g_assert(err == 0);
 219
 220         err = __connman_iptables_commit(AF_INET, "filter");
 221         g_assert(err == 0);
 222
 223         assert_rule_exists(AF_INET, "filter",
 224                                 "-A INPUT -m mark --mark 0x1 -j LOG");
 225
 226         err = __connman_iptables_delete(AF_INET, "filter", "INPUT",
 227                                         "-m mark --mark 1 -j LOG");
 228         g_assert(err == 0);
 229
 230         err = __connman_iptables_commit(AF_INET, "filter");
 231         g_assert(err == 0);
 232
 233         assert_rule_not_exists(AF_INET, "filter",
 234                                 "-A INPUT -m mark --mark 0x1 -j LOG");
 235 }
 236
 237 static void test_iptables_rule1(void)
 238 {
 239         int err;
 240
 241         /* Test if we can do NAT stuff */
 242
 243         err = __connman_iptables_append(AF_INET, "nat", "POSTROUTING",
 244                                 "-s 10.10.1.0/24 -o eth0 -j MASQUERADE");
 245
 246         err = __connman_iptables_commit(AF_INET, "nat");
 247         g_assert(err == 0);
 248
 249         assert_rule_exists(AF_INET, "nat",
 250                 "-A POSTROUTING -s 10.10.1.0/24 -o eth0 -j MASQUERADE");
 251
 252         err = __connman_iptables_delete(AF_INET, "nat", "POSTROUTING",
 253                                 "-s 10.10.1.0/24 -o eth0 -j MASQUERADE");
 254
 255         err = __connman_iptables_commit(AF_INET, "nat");
 256         g_assert(err == 0);
 257
 258         assert_rule_not_exists(AF_INET, "nat",
 259                 "-A POSTROUTING -s 10.10.1.0/24 -o eth0 -j MASQUERADE");
 260 }
 261
 262 static void test_iptables_rule2(void)
 263 {
 264         int err;
 265
 266         /* Test if the right rule is removed */
 267
 268         err = __connman_iptables_append(AF_INET, "filter", "INPUT",
 269                                         "-m mark --mark 1 -j LOG");
 270         g_assert(err == 0);
 271
 272         err = __connman_iptables_commit(AF_INET, "filter");
 273         g_assert(err == 0);
 274
 275         assert_rule_exists(AF_INET, "filter",
 276                                 "-A INPUT -m mark --mark 0x1 -j LOG");
 277
 278         err = __connman_iptables_append(AF_INET, "filter", "INPUT",
 279                                         "-m mark --mark 2 -j LOG");
 280         g_assert(err == 0);
 281
 282         err = __connman_iptables_commit(AF_INET, "filter");
 283         g_assert(err == 0);
 284
 285         assert_rule_exists(AF_INET, "filter",
 286                                 "-A INPUT -m mark --mark 0x1 -j LOG");
 287         assert_rule_exists(AF_INET, "filter",
 288                                 "-A INPUT -m mark --mark 0x2 -j LOG");
 289
 290         err = __connman_iptables_delete(AF_INET, "filter", "INPUT",
 291                                         "-m mark --mark 2 -j LOG");
 292         g_assert(err == 0);
 293
 294         err = __connman_iptables_commit(AF_INET, "filter");
 295         g_assert(err == 0);
 296
 297         assert_rule_exists(AF_INET, "filter",
 298                                 "-A INPUT -m mark --mark 0x1 -j LOG");
 299         assert_rule_not_exists(AF_INET, "filter",
 300                                 "-A INPUT -m mark --mark 0x2 -j LOG");
 301
 302         err = __connman_iptables_delete(AF_INET, "filter", "INPUT",
 303                                         "-m mark --mark 1 -j LOG");
 304         g_assert(err == 0);
 305
 306         err = __connman_iptables_commit(AF_INET, "filter");
 307         g_assert(err == 0);
 308
 309         assert_rule_not_exists(AF_INET, "filter",
 310                                 "-A INPUT -m mark --mark 0x1 -j LOG");
 311 }
 312
 313 static void test_iptables_target0(void)
 314 {
 315         int err;
 316
 317         /* Test if 'fallthrough' targets work */
 318
 319         err = __connman_iptables_append(AF_INET, "filter", "INPUT",
 320                                         "-m mark --mark 1");
 321         g_assert(err == 0);
 322
 323         err = __connman_iptables_append(AF_INET, "filter", "INPUT",
 324                                         "-m mark --mark 2");
 325         g_assert(err == 0);
 326
 327         err = __connman_iptables_commit(AF_INET, "filter");
 328         g_assert(err == 0);
 329
 330         assert_rule_exists(AF_INET, "filter", "-A INPUT -m mark --mark 0x1");
 331         assert_rule_exists(AF_INET, "filter", "-A INPUT -m mark --mark 0x2");
 332
 333         err = __connman_iptables_delete(AF_INET, "filter", "INPUT",
 334                                         "-m mark --mark 1");
 335         g_assert(err == 0);
 336
 337         err = __connman_iptables_commit(AF_INET, "filter");
 338         g_assert(err == 0);
 339
 340         err = __connman_iptables_delete(AF_INET, "filter", "INPUT",
 341                                         "-m mark --mark 2");
 342         g_assert(err == 0);
 343
 344         err = __connman_iptables_commit(AF_INET, "filter");
 345         g_assert(err == 0);
 346
 347         assert_rule_not_exists(AF_INET, "filter",
 348                                         "-A INPUT -m mark --mark 0x1");
 349         assert_rule_not_exists(AF_INET, "filter",
 350                                         "-A INPUT -m mark --mark 0x2");
 351 }
 352
 353 static void test_ip6tables_chain0(void)
 354 {
 355         int err;
 356
 357         err = __connman_iptables_new_chain(AF_INET6, "filter", "foo");
 358         g_assert(err == 0);
 359
 360         err = __connman_iptables_commit(AF_INET6, "filter");
 361         g_assert(err == 0);
 362
 363         assert_rule_exists(AF_INET6, "filter", ":foo - [0:0]");
 364
 365         err = __connman_iptables_delete_chain(AF_INET6, "filter", "foo");
 366         g_assert(err == 0);
 367
 368         err = __connman_iptables_commit(AF_INET6, "filter");
 369         g_assert(err == 0);
 370
 371         assert_rule_not_exists(AF_INET6, "filter", ":foo - [0:0]");
 372 }
 373
 374 static void test_ip6tables_chain1(void)
 375 {
 376         int err;
 377
 378         err = __connman_iptables_new_chain(AF_INET6, "filter", "foo");
 379         g_assert(err == 0);
 380
 381         err = __connman_iptables_commit(AF_INET6, "filter");
 382         g_assert(err == 0);
 383
 384         err = __connman_iptables_flush_chain(AF_INET6, "filter", "foo");
 385         g_assert(err == 0);
 386
 387         err = __connman_iptables_commit(AF_INET6, "filter");
 388         g_assert(err == 0);
 389
 390         err = __connman_iptables_delete_chain(AF_INET6, "filter", "foo");
 391         g_assert(err == 0);
 392
 393         err = __connman_iptables_commit(AF_INET6, "filter");
 394         g_assert(err == 0);
 395 }
 396
 397 static void test_ip6tables_chain2(void)
 398 {
 399         int err;
 400
 401         err = __connman_iptables_change_policy(AF_INET6, "filter", "INPUT",
 402                                                         "DROP");
 403         g_assert(err == 0);
 404
 405         err = __connman_iptables_commit(AF_INET6, "filter");
 406         g_assert(err == 0);
 407
 408         err = __connman_iptables_change_policy(AF_INET6, "filter", "INPUT",
 409                                                                 "ACCEPT");
 410         g_assert(err == 0);
 411
 412         err = __connman_iptables_commit(AF_INET6, "filter");
 413         g_assert(err == 0);
 414 }
 415
 416 static void test_ip6tables_chain3(void)
 417 {
 418         int err;
 419
 420         err = __connman_iptables_new_chain(AF_INET6, "filter", "user-chain-0");
 421         g_assert(err == 0);
 422
 423         err = __connman_iptables_commit(AF_INET6, "filter");
 424         g_assert(err == 0);
 425
 426         assert_rule_exists(AF_INET6, "filter", ":user-chain-0 - [0:0]");
 427
 428         err = __connman_iptables_new_chain(AF_INET6, "filter", "user-chain-1");
 429         g_assert(err == 0);
 430
 431         err = __connman_iptables_commit(AF_INET6, "filter");
 432         g_assert(err == 0);
 433
 434         assert_rule_exists(AF_INET6, "filter", ":user-chain-0 - [0:0]");
 435         assert_rule_exists(AF_INET6, "filter", ":user-chain-1 - [0:0]");
 436
 437         err = __connman_iptables_delete_chain(AF_INET6, "filter",
 438                                                 "user-chain-1");
 439         g_assert(err == 0);
 440
 441         err = __connman_iptables_commit(AF_INET6, "filter");
 442         g_assert(err == 0);
 443
 444         assert_rule_exists(AF_INET6, "filter", ":user-chain-0 - [0:0]");
 445         assert_rule_not_exists(AF_INET6, "filter", ":user-chain-1 - [0:0]");
 446
 447         err = __connman_iptables_delete_chain(AF_INET6, "filter",
 448                                                 "user-chain-0");
 449         g_assert(err == 0);
 450
 451         err = __connman_iptables_commit(AF_INET6, "filter");
 452         g_assert(err == 0);
 453
 454         assert_rule_not_exists(AF_INET6, "filter", ":user-chain-0 - [0:0]");
 455 }
 456
 457 static void test_ip6tables_rule0(void)
 458 {
 459         int err;
 460
 461         /* Test simple appending and removing a rule */
 462
 463         err = __connman_iptables_append(AF_INET6, "filter", "INPUT",
 464                                         "-m mark --mark 1 -j LOG");
 465         g_assert(err == 0);
 466
 467         err = __connman_iptables_commit(AF_INET6, "filter");
 468         g_assert(err == 0);
 469
 470         assert_rule_exists(AF_INET6, "filter",
 471                                 "-A INPUT -m mark --mark 0x1 -j LOG");
 472
 473         err = __connman_iptables_delete(AF_INET6, "filter", "INPUT",
 474                                         "-m mark --mark 1 -j LOG");
 475         g_assert(err == 0);
 476
 477         err = __connman_iptables_commit(AF_INET6, "filter");
 478         g_assert(err == 0);
 479
 480         assert_rule_not_exists(AF_INET6, "filter",
 481                                 "-A INPUT -m mark --mark 0x1 -j LOG");
 482 }
 483
 484 static void test_ip6tables_rule1(void)
 485 {
 486         int err;
 487
 488         /* Test if the right rule is removed */
 489
 490         err = __connman_iptables_append(AF_INET6, "filter", "INPUT",
 491                                         "-m mark --mark 1 -j LOG");
 492         g_assert(err == 0);
 493
 494         err = __connman_iptables_commit(AF_INET6, "filter");
 495         g_assert(err == 0);
 496
 497         assert_rule_exists(AF_INET6, "filter",
 498                                 "-A INPUT -m mark --mark 0x1 -j LOG");
 499
 500         err = __connman_iptables_append(AF_INET6, "filter", "INPUT",
 501                                         "-m mark --mark 2 -j LOG");
 502         g_assert(err == 0);
 503
 504         err = __connman_iptables_commit(AF_INET6, "filter");
 505         g_assert(err == 0);
 506
 507         assert_rule_exists(AF_INET6, "filter",
 508                                 "-A INPUT -m mark --mark 0x1 -j LOG");
 509         assert_rule_exists(AF_INET6, "filter",
 510                                 "-A INPUT -m mark --mark 0x2 -j LOG");
 511
 512         err = __connman_iptables_delete(AF_INET6, "filter", "INPUT",
 513                                         "-m mark --mark 2 -j LOG");
 514         g_assert(err == 0);
 515
 516         err = __connman_iptables_commit(AF_INET6, "filter");
 517         g_assert(err == 0);
 518
 519         assert_rule_exists(AF_INET6, "filter",
 520                                 "-A INPUT -m mark --mark 0x1 -j LOG");
 521         assert_rule_not_exists(AF_INET6, "filter",
 522                                 "-A INPUT -m mark --mark 0x2 -j LOG");
 523
 524         err = __connman_iptables_delete(AF_INET6, "filter", "INPUT",
 525                                         "-m mark --mark 1 -j LOG");
 526         g_assert(err == 0);
 527
 528         err = __connman_iptables_commit(AF_INET6, "filter");
 529         g_assert(err == 0);
 530
 531         assert_rule_not_exists(AF_INET6, "filter",
 532                                 "-A INPUT -m mark --mark 0x1 -j LOG");
 533 }
 534
 535 static void test_ip6tables_rule2(void)
 536 {
 537         int err;
 538
 539         err = __connman_iptables_append(AF_INET6, "filter", "INPUT",
 540                                         "-p icmpv6 -m icmpv6 "
 541                                         "--icmpv6-type 128/0 -j DROP");
 542         g_assert(err == 0);
 543
 544         err = __connman_iptables_commit(AF_INET6, "filter");
 545
 546         g_assert(err == 0);
 547
 548         assert_rule_exists(AF_INET6, "filter", "-A INPUT -p ipv6-icmp "
 549                                         "-m icmp6 --icmpv6-type 128/0 -j DROP");
 550
 551         err = __connman_iptables_append(AF_INET6, "filter", "OUTPUT",
 552                                         "-p icmpv6 -m icmpv6 "
 553                                         "--icmpv6-type 129/0 -j DROP");
 554         g_assert(err == 0);
 555
 556         err = __connman_iptables_commit(AF_INET6, "filter");
 557
 558         g_assert(err == 0);
 559
 560         assert_rule_exists(AF_INET6, "filter", "-A OUTPUT -p ipv6-icmp "
 561                                         "-m icmp6 --icmpv6-type 129/0 -j DROP");
 562
 563         err = __connman_iptables_delete(AF_INET6, "filter", "INPUT",
 564                                         "-p icmpv6 -m icmpv6 "
 565                                         "--icmpv6-type 128/0 -j DROP");
 566
 567         g_assert(err == 0);
 568
 569         err = __connman_iptables_delete(AF_INET6, "filter", "OUTPUT",
 570                                         "-p icmpv6 -m icmpv6 "
 571                                         "--icmpv6-type 129/0 -j DROP");
 572
 573         g_assert(err == 0);
 574
 575         err = __connman_iptables_commit(AF_INET6, "filter");
 576
 577         g_assert(err == 0);
 578
 579 }
 580
 581 static void test_ip6tables_target0(void)
 582 {
 583         int err;
 584
 585         /* Test if 'fallthrough' targets work */
 586
 587         err = __connman_iptables_append(AF_INET6, "filter", "INPUT",
 588                                         "-m mark --mark 1");
 589         g_assert(err == 0);
 590
 591         err = __connman_iptables_append(AF_INET6, "filter", "INPUT",
 592                                         "-m mark --mark 2");
 593         g_assert(err == 0);
 594
 595         err = __connman_iptables_commit(AF_INET6, "filter");
 596         g_assert(err == 0);
 597
 598         assert_rule_exists(AF_INET6, "filter", "-A INPUT -m mark --mark 0x1");
 599         assert_rule_exists(AF_INET6, "filter", "-A INPUT -m mark --mark 0x2");
 600
 601         err = __connman_iptables_delete(AF_INET6, "filter", "INPUT",
 602                                         "-m mark --mark 1");
 603         g_assert(err == 0);
 604
 605         err = __connman_iptables_commit(AF_INET6, "filter");
 606         g_assert(err == 0);
 607
 608         err = __connman_iptables_delete(AF_INET6, "filter", "INPUT",
 609                                         "-m mark --mark 2");
 610         g_assert(err == 0);
 611
 612         err = __connman_iptables_commit(AF_INET6, "filter");
 613         g_assert(err == 0);
 614
 615         assert_rule_not_exists(AF_INET6, "filter", "-A INPUT "
 616                                         "-m mark --mark 0x1");
 617         assert_rule_not_exists(AF_INET6, "filter", "-A INPUT "
 618                                         "-m mark --mark 0x2");
 619 }
 620
 621 const struct connman_notifier *nat_notifier;
 622
 623 struct connman_service {
 624         char *dummy;
 625 };
 626
 627 char *connman_service_get_interface(struct connman_service *service)
 628 {
 629         return "eth0";
 630 }
 631
 632 int connman_notifier_register(const struct connman_notifier *notifier)
 633 {
 634         nat_notifier = notifier;
 635
 636         return 0;
 637 }
 638
 639 void connman_notifier_unregister(const struct connman_notifier *notifier)
 640 {
 641         nat_notifier = NULL;
 642 }
 643
 644 static void test_nat_basic0(void)
 645 {
 646         int err;
 647
 648         err = __connman_nat_enable("bridge", "192.168.2.1", 24);
 649         g_assert(err == 0);
 650
 651         /* test that table is empty */
 652         err = __connman_iptables_append(AF_INET, "nat", "POSTROUTING",
 653                                         "-s 192.168.2.1/24 -o eth0 -j MASQUERADE");
 654         g_assert(err == 0);
 655
 656         err = __connman_iptables_commit(AF_INET, "nat");
 657         g_assert(err == 0);
 658
 659         assert_rule_exists(AF_INET, "nat",
 660                 "-A POSTROUTING -s 192.168.2.0/24 -o eth0 -j MASQUERADE");
 661
 662         err = __connman_iptables_delete(AF_INET, "nat", "POSTROUTING",
 663                                         "-s 192.168.2.1/24 -o eth0 -j MASQUERADE");
 664         g_assert(err == 0);
 665
 666         err = __connman_iptables_commit(AF_INET, "nat");
 667         g_assert(err == 0);
 668
 669         assert_rule_not_exists(AF_INET, "nat",
 670                 "-A POSTROUTING -s 192.168.2.0/24 -o eth0 -j MASQUERADE");
 671
 672         __connman_nat_disable("bridge");
 673 }
 674
 675 static void test_nat_basic1(void)
 676 {
 677         struct connman_service *service;
 678         int err;
 679
 680         service = g_try_new0(struct connman_service, 1);
 681         g_assert(service);
 682
 683         nat_notifier->default_changed(service);
 684
 685         err = __connman_nat_enable("bridge", "192.168.2.1", 24);
 686         g_assert(err == 0);
 687
 688         /* test that table is not empty */
 689         err = __connman_iptables_append(AF_INET, "nat", "POSTROUTING",
 690                                         "-s 192.168.2.1/24 -o eth0 -j MASQUERADE");
 691         g_assert(err == 0);
 692
 693         err = __connman_iptables_commit(AF_INET, "nat");
 694         g_assert(err == 0);
 695
 696         __connman_nat_disable("bridge");
 697
 698         /* test that table is empty again */
 699         err = __connman_iptables_delete(AF_INET, "nat", "POSTROUTING",
 700                                         "-s 192.168.2.1/24 -o eth0 -j MASQUERADE");
 701         g_assert(err == 0);
 702
 703         err = __connman_iptables_commit(AF_INET, "nat");
 704         g_assert(err == 0);
 705
 706         g_free(service);
 707 }
 708
 709 static gchar *option_debug = NULL;
 710
 711 static bool parse_debug(const char *key, const char *value,
 712                                         gpointer user_data, GError **error)
 713 {
 714         if (value)
 715                 option_debug = g_strdup(value);
 716         else
 717                 option_debug = g_strdup("*");
 718
 719         return true;
 720 }
 721
 722 static GOptionEntry options[] = {
 723         { "debug", 'd', G_OPTION_FLAG_OPTIONAL_ARG,
 724                                 G_OPTION_ARG_CALLBACK, parse_debug,
 725                                 "Specify debug options to enable", "DEBUG" },
 726         { NULL },
 727 };
 728
 729 int main(int argc, char *argv[])
 730 {
 731         GOptionContext *context;
 732         GError *error = NULL;
 733         int err;
 734
 735         g_test_init(&argc, &argv, NULL);
 736
 737         context = g_option_context_new(NULL);
 738         g_option_context_add_main_entries(context, options, NULL);
 739
 740         if (!g_option_context_parse(context, &argc, &argv, &error)) {
 741                 if (error) {
 742                         g_printerr("%s\n", error->message);
 743                         g_error_free(error);
 744                 } else
 745                         g_printerr("An unknown error occurred\n");
 746                 return 1;
 747         }
 748
 749         g_option_context_free(context);
 750
 751         __connman_log_init(argv[0], option_debug, false, false,
 752                         "Unit Tests Connection Manager", VERSION);
 753
 754         __connman_iptables_init();
 755         __connman_nat_init();
 756
 757         g_test_add_func("/iptables/chain0", test_iptables_chain0);
 758         g_test_add_func("/iptables/chain1", test_iptables_chain1);
 759         g_test_add_func("/iptables/chain2", test_iptables_chain2);
 760         g_test_add_func("/iptables/chain3", test_iptables_chain3);
 761         g_test_add_func("/iptables/rule0",  test_iptables_rule0);
 762         g_test_add_func("/iptables/rule1",  test_iptables_rule1);
 763         g_test_add_func("/iptables/rule2",  test_iptables_rule2);
 764         g_test_add_func("/iptables/target0", test_iptables_target0);
 765         g_test_add_func("/ip6tables/chain0", test_ip6tables_chain0);
 766         g_test_add_func("/ip6tables/chain1", test_ip6tables_chain1);
 767         g_test_add_func("/ip6tables/chain2", test_ip6tables_chain2);
 768         g_test_add_func("/ip6tables/chain3", test_ip6tables_chain3);
 769         g_test_add_func("/ip6tables/rule0",  test_ip6tables_rule0);
 770         g_test_add_func("/ip6tables/rule1",  test_ip6tables_rule1);
 771         g_test_add_func("/ip6tables/rule2",  test_ip6tables_rule2);
 772         g_test_add_func("/ip6tables/target0", test_ip6tables_target0);
 773         g_test_add_func("/nat/basic0", test_nat_basic0);
 774         g_test_add_func("/nat/basic1", test_nat_basic1);
 775
 776         err = g_test_run();
 777
 778         __connman_nat_cleanup();
 779         __connman_iptables_cleanup();
 780
 781         g_free(option_debug);
 782
 783         return err;
 784 }